Routers throughout networks (e.g., the Internet), may be configured to process network traffic based on information contained in the network traffic. For example, some companies have tried to manipulate quality of service settings for packets associated with file sharing applications. Conventional methods may attempt deep packet inspection (DPI) to detect an application with which a packet is associated. DPI is the act of examining packet payload contents. However, DPI may have difficulty determining what application a packet is associated with when the payload is encrypted. Additionally, DPI may be slow and/or resource intensive (e.g., memory, processing). Thus, regular use of DPI may introduce latency in network devices causing network slowdowns and reducing data transfer speeds. Further, some DPI implementations may have high false positive rates, and false negatives may be introduced by manipulating packet payloads with polymorphic techniques (e.g., computer viruses that rewrite their code).
Some routers use statistical classification techniques to augment other classification techniques instead of using DPI. However, some conventional statistical classification techniques that use software for gathering data are computationally high cost, slow, and therefore impractical for some typical classification scenarios. Additionally, some conventional statistical classification techniques do not reach a conclusion about a given data stream until after the stream has terminated.